# Filebeat. Read each time from the beginning of the file. How?

**URL:** <https://discuss.elastic.co/t/filebeat-read-each-time-from-the-beginning-of-the-file-how/325693>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 16, 2023, 7:26am UTC](https://discuss.elastic.co/t/filebeat-read-each-time-from-the-beginning-of-the-file-how/325693 "2023-02-16T07:26:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![cheburasshka](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cheburasshka/32/117338_2.png) [@cheburasshka](https://discuss.elastic.co/u/cheburasshka)\
**Post date:** [February 16, 2023, 7:26am UTC](https://discuss.elastic.co/t/filebeat-read-each-time-from-the-beginning-of-the-file-how/325693/1 "2023-02-16T07:26:04Z")

</div>

Hi. Faced with such a need: I need to read the file every time from the beginning of the file and send events.  
I have a file that is completely updated every 10 seconds, that is, the old content is overwritten with new content. If the new content is smaller (truncated is triggered) or equal to the old content (_prospector.scanner.resend\_on\_touch_: true), then there are no problems. But if the new content has become larger, then I can't get filebeat to read the file from the beginning, the _clean\_inactive_ setting doesn't help.

Can anyone tell me how to force filebeat read the contents of the file every time from the beginning of the file?

Tested on filebeat versions 7.16 and 8.6  
My config:

```auto
filebeat.registry.flush: 1s
filebeat.config.modules.path: ${path.config}/modules.d/*.yml
logging.metrics.enabled: false
logging.level: debug

filebeat.inputs:

- type: filestream
  enabled: true
  id: health-check
  paths:
  - D:\testlog\status\*
  encoding: utf-8
  include_lines: ['^{"']
  prospector.scanner.check_interval: 4s
  close.reader.on_eof: true
  clean_inactive: 2s
  prospector.scanner.resend_on_touch: true

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 16, 2023, 9:26am UTC](https://discuss.elastic.co/t/filebeat-read-each-time-from-the-beginning-of-the-file-how/325693/2 "2023-03-16T09:26:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.